[chore](tools) Add release helper scripts for cutting a source release candidate by morningman · Pull Request #64062 · apache/doris

morningman · 2026-06-03T07:41:12Z

What problem does this PR solve?

Problem Summary:

Add tools/release-tools/, a set of helper scripts for a Release Manager (RM) to cut an Apache Doris source release candidate in three steps:

01-check-env.sh — check / prepare the GPG signing environment and ASF credentials.
02-package-sign-upload.sh — git archive the tag, GPG-sign, generate sha512, upload to the dev SVN.
03-vote-mail.sh — generate the [VOTE] email draft.
release.env — shared config (version, paths, signing key, SVN URLs, email); edit per release.
README.md — usage.

The scripts are reusable across releases (everything version-specific lives in release.env). Branch prep, issue cleanup, patch merges and tag creation are out of scope.

Release note

None

Check List (For Author)

Test
- No need to test or manual test. Explain why:
  - Other reason: standalone Release-Manager helper scripts under tools/; not part of the build or product runtime.
Behavior changed:
- No.
Does this need documentation?
- No. (A README.md is included in this PR.)

…e candidate Add tools/release-tools/, a set of helper scripts for a Release Manager to cut an Apache Doris source release candidate in three steps: - 00-check-env.sh: check/prepare the GPG signing environment and ASF credentials - 10-package-sign-upload.sh: git-archive the tag, GPG-sign, sha512, upload to the dev SVN - 20-vote-mail.sh: generate the [VOTE] email draft - release.env: shared config (version, paths, signing key, SVN URLs, email) - README.md: usage These are standalone RM helper scripts and are not part of the build or product runtime. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hello-stephen · 2026-06-03T07:41:17Z

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

What problem was fixed (it's best to include specific error reporting information). How it was fixed.
Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
What features were added. Why was this function added?
Which code was refactored and why was this part of the code refactored?
Which functions were optimized and what is the difference before and after the optimization?

morningman · 2026-06-03T07:50:18Z

run skipall

morningman · 2026-06-03T08:07:09Z

run skipall

morningman · 2026-06-03T08:13:44Z

run buildall

…tleaks tools/release-tools/release.env legitimately carries a public GPG key fingerprint in SIGNING_KEY; gitleaks' generic-api-key rule flagged it as a secret. Add a path+line allowlist scoped to that file, matching the style of the existing test-fixture allowlists under the same rule. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

morningman · 2026-06-03T15:51:30Z

run buildall

morningman · 2026-06-03T15:58:53Z

run buildall

…template Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

morningman · 2026-06-04T02:02:02Z

run buildall

morningman · 2026-06-04T04:07:06Z

/review

github-actions

Summary: I found release-tool workflow issues that should be fixed before merging. The main blocker is that the source-release packaging path is documented as source-only/optional for binaries, but the default config makes three binary artifacts mandatory and aborts before upload if they are absent. The vote draft also unconditionally advertises hard-coded binary URLs and hard-codes a signer display name, which can produce an incorrect public VOTE email for any configuration that differs from this one.

Critical checkpoint conclusions:

Goal/test: The goal is to provide reusable release-manager helper scripts. Basic shell syntax passes with bash -n, but the default source-release flow is not proven and currently fails unless binary artifacts exist.
Scope/clarity: The change is focused under tools plus config, but the reusable configuration is not consistently used by the email generator.
Concurrency/lifecycle: No concurrent runtime code or special lifecycle management involved.
Configuration: New release.env config is central to the feature; several generated outputs ignore or contradict it.
Compatibility/storage/transactions/FE-BE: Not applicable; no product runtime paths changed.
Tests/results: No automated functional test is included; for these scripts, at least bash -n was checked locally, but an end-to-end dry run/source-only path would be needed after fixes.
Observability: Script output is generally adequate for an RM workflow.
User focus: No additional user-provided review focus was supplied.

github-actions · 2026-06-04T04:13:40Z

+# Step 02 writes a .asc signature and a .sha512 checksum NEXT TO each file below.
+# These are NOT uploaded by the scripts and are NOT part of the source-only vote SVN;
+# you upload the binaries together with their .asc/.sha512 yourself, wherever they go.
+# Set absolute paths to your three prebuilt binary tarballs (adjust the directory):


This default makes binary signing mandatory even though the PR/README describe a source-release workflow where BIN_FILES is optional and can be left empty. With this file as committed, 02-package-sign-upload.sh computes bin_count=3 and dies on the first missing ${WORK_DIR}/apache-doris-${VERSION}-bin-*.tar.gz before reaching the dev SVN upload. Please make the default BIN_FILES=() and leave these paths as commented examples, or otherwise gate binary signing so the source-only path works out of the box.

github-actions · 2026-06-04T04:13:40Z

+The artifacts (source, signature and checksum) corresponding to this release
+candidate can be found here:
+${DEV_SVN_DIR}/
+


The vote draft always advertises these three hard-coded convenience binary URLs, independent of BIN_FILES and independent of whether the RM actually signed/uploaded binaries. That contradicts the optional binary flow and can produce a public VOTE email with broken or stale links. The email should derive this section from configured/uploaded binary artifacts, or omit/prompt for it when binaries are not part of the RC.

github-actions · 2026-06-04T04:13:40Z

+${VERIFY_GUIDE_URL}
+
+The vote will be open for at least 72 hours.
+[ ] +1 Approve the release


The scripts make APACHE_ID and APACHE_EMAIL configurable, but the generated mail still hard-codes Mingyu Chen. If another RM edits release.env, the draft signs their vote email with someone else's display name. Please move the display name to release.env or prompt/derive it consistently with the configured Apache identity.

hello-stephen

LGTM

github-actions · 2026-06-04T04:55:15Z

PR approved by at least one committer and no changes requested.

…email Fixes the three review comments on apache#64062: - release.env: default BIN_FILES=() so the documented source-only flow works out of the box (02 no longer dies on missing binaries); keep the example paths as comments. Add BIN_DOWNLOAD_BASE and SIGNER_NAME config vars. - 03-vote-mail.sh: derive the convenience-binary section from BIN_FILES and omit it when the list is empty, instead of hard-coding URLs; use ${SIGNER_NAME} for the signature instead of a hard-coded name. - README: document SIGNER_NAME / BIN_DOWNLOAD_BASE and the empty-by-default BIN_FILES behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

morningman · 2026-06-04T06:08:48Z

run buildall

morningman · 2026-06-04T06:08:52Z

/review

dismiss

2

51f8496

morningman and others added 2 commits June 3, 2026 17:11

3

58ffd9e

3

207b27d

[chore](tools) add convenience binaries download links to vote email …

2a3bf1a

…template Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions Bot previously requested changes Jun 4, 2026

View reviewed changes

hello-stephen previously approved these changes Jun 4, 2026

View reviewed changes

github-actions Bot added the approved Indicates a PR has been approved by one committer. label Jun 4, 2026

morningman dismissed hello-stephen’s stale review via 96d8792 June 4, 2026 06:07

github-actions Bot removed the approved Indicates a PR has been approved by one committer. label Jun 4, 2026

hello-stephen approved these changes Jun 4, 2026

View reviewed changes

morningman merged commit f85e3a2 into apache:master Jun 4, 2026
34 checks passed

Conversation

morningman commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What problem does this PR solve?

Release note

Check List (For Author)

Uh oh!

hello-stephen commented Jun 3, 2026

Uh oh!

morningman commented Jun 3, 2026

Uh oh!

morningman commented Jun 3, 2026

Uh oh!

morningman commented Jun 3, 2026

Uh oh!

morningman commented Jun 3, 2026

Uh oh!

morningman commented Jun 3, 2026

Uh oh!

morningman commented Jun 4, 2026

Uh oh!

morningman commented Jun 4, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

hello-stephen left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 4, 2026

Uh oh!

morningman commented Jun 4, 2026

Uh oh!

morningman commented Jun 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

morningman commented Jun 3, 2026 •

edited

Loading